Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Re: Search head bundle replication failed due to 4...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi.
I am upgrading from 8.1.0 to 8.2.1. I received the bundle replication issue as below:
Problem replicating config (bundle) to search peer ' 10.150.x.x:8089 ', Upload bundle="/opt/splunk/var/run/SHD01-1625054310.bundle" to peer name=IND01 uri=https://10.150.x.x:8089 failed; http_status=409 http_description="Conflict".
I received an error for each member of indexer cluster. My search head is a standalone server.
Could anyone please help?
Linh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sure your search head is actually tied to the indexers.
If you run the following you should get back a list of all the indexers in your cluster.
|tstats count where index=* by splunk_server
Bundle failure can also occur if all your $SPLUNK_HOME directories are not owned by the splunk user.
Using a chown -RP splunk:splunk never hurts (assuming your Splunk user is "splunk".
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sure your search head is actually tied to the indexers.
If you run the following you should get back a list of all the indexers in your cluster.
|tstats count where index=* by splunk_server
Bundle failure can also occur if all your $SPLUNK_HOME directories are not owned by the splunk user.
Using a chown -RP splunk:splunk never hurts (assuming your Splunk user is "splunk".
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm facing the same issue for version 8.2.1, but instead of upgrade, I just received this error suddenly.
It is there any solution to this problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ambrosesuenDid you ever figure this out?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
